DeathMetal: Red team & penetration testing tools to exploit the capabilities of Intel AMT

by do son · Published April 11, 2019 · Updated October 10, 2021

DeathMetal

DeathMetal is a suite of tools that interact with Intel AMT. It’s kind of a foray into a world filled with intrigue and reversing puzzles with useful results.

Since this is super serious, tools are named after Metalocalypse characters.

Tools are prefixed with “dm_” to help with tab-completion and recognition.

dm_pickles – Duckyscript interpreter that communicates over AMT KVM (vnc) and injects keystrokes.
dm_toki – IDE-R implementation – lets you attach floopy and CD images remotely to the target computer.
dm_nathan – Is a cli that allows for configuring AMT via authenticated channel
dm_rockso – Presence and version scanner, can help you find AMT capable systems regardless of provisioning status. (works even if explicitly not-enabled)

Code that is common to more than one tool lives in a library called ‘Charles’, at the moment it can pretty much just help set up Redirection service stuff.

Download